# Data classification, ownership and lineage

Move from a file label to a data passport with business purpose, ownership, copies and handling conditions.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Understand data in business context

Fictional Harbor holds contracts, customer summaries and product notices. Similar file formats do not imply equal sensitivity. A data owner identifies the business purpose, required fields, consequences of unauthorized disclosure and existing copies. A system administrator may operate storage without owning every business decision. Map the technical inventory to business accountability. This exercise contains synthetic metadata rather than personal records. Classification results do not automatically determine a person’s trustworthiness or an organization’s legal compliance; they support appropriate handling decisions.

## Connect labels to handling rules

Harbor’s teaching profile uses public, internal, confidential and restricted. These four names are not a universal standard or every product’s defaults. Define recipients, channels and controls for each label. Seeing a label on a file does not establish enforcement by the destination application. Review mislabeling and label loss during export too. Business owners and operators define exceptions and reclassification triggers. Learners decide from explicit handling rules rather than color alone. The local tool trusts declared labels and does not inspect content to confirm that classification.

## Lineage and copies

A customer table may produce reports, exports, test copies and backups. Recording these relationships helps scope permission changes, correction and disposal. A copy can have different controls in another environment. Removing the primary file does not remove every derivative. Harbor’s passport separates source, purpose, recipient and derivative ownership. Real discovery requires authorized source access; this package searches no network files. Unknown copies remain explicit gaps rather than being marked complete. A lineage drawing supports investigation but is not proof that every copy was found or that a downstream system applied a change.

## Changing data and changing controls

A new field, recipient or combined dataset can change sensitivity. Two individually low-risk fields can become identifying together. Trigger catalog review on these changes as well as a schedule. NIST SP 800-122 is a dated foundation for PII confidentiality, not a substitute for current law. A Harbor reclassification stays a record for owner review and applies no label to an actual file. The desired output is a versioned passport explaining purpose, owner, controls and copy boundaries, with uncertainty visible rather than hidden behind a completed catalog entry.

## Working sequence

1. Define business purpose and data owner.
2. Classify fields through consequence and context.
3. Map source and derivative copies.
4. Connect labels to sharing and retention rules.
5. Record change triggers and open gaps.

## 1. Label exists: who owns it?

A label establishes neither business ownership nor handling rules. Treating a labeled file as controlled without consequence and ownership review relies on incomplete evidence.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.labelExists === true
```

### Corrected implementation
```js
s => s.labelExists === true &&
  s.businessOwner === true &&
  s.impactReviewed === true &&
  s.handlingDefined === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "labelExists": true,
        "businessOwner": true,
        "impactReviewed": true,
        "handlingDefined": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-businessOwner",
      "input": {
        "labelExists": true,
        "businessOwner": false,
        "impactReviewed": true,
        "handlingDefined": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-handlingDefined",
      "input": {
        "labelExists": true,
        "businessOwner": true,
        "impactReviewed": true,
        "handlingDefined": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "labelExists": true,
        "businessOwner": true,
        "impactReviewed": true,
        "handlingDefined": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-businessOwner",
      "input": {
        "labelExists": true,
        "businessOwner": false,
        "impactReviewed": true,
        "handlingDefined": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-handlingDefined",
      "input": {
        "labelExists": true,
        "businessOwner": true,
        "impactReviewed": true,
        "handlingDefined": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Personal-data list

A field list explains neither purpose nor combination risk. Individually innocuous fields are insufficient evidence without reviewing copies and context.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.piiListed === true
```

### Corrected implementation
```js
s => s.piiListed === true &&
  s.purposeMapped === true &&
  s.combinationRisk === true &&
  s.copiesScoped === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "piiListed": true,
        "purposeMapped": true,
        "combinationRisk": true,
        "copiesScoped": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-purposeMapped",
      "input": {
        "piiListed": true,
        "purposeMapped": false,
        "combinationRisk": true,
        "copiesScoped": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-combinationRisk",
      "input": {
        "piiListed": true,
        "purposeMapped": true,
        "combinationRisk": false,
        "copiesScoped": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "piiListed": true,
        "purposeMapped": true,
        "combinationRisk": true,
        "copiesScoped": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-purposeMapped",
      "input": {
        "piiListed": true,
        "purposeMapped": false,
        "combinationRisk": true,
        "copiesScoped": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-combinationRisk",
      "input": {
        "piiListed": true,
        "purposeMapped": true,
        "combinationRisk": false,
        "copiesScoped": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Is the catalog complete?

A catalog supplies neither lineage nor change tracking. Without source, derivatives and review ownership, new-copy risks can remain invisible.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.catalogExists === true
```

### Corrected implementation
```js
s => s.catalogExists === true &&
  s.lineageKnown === true &&
  s.changeTrigger === true &&
  s.reviewOwned === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "catalogExists": true,
        "lineageKnown": true,
        "changeTrigger": true,
        "reviewOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-lineageKnown",
      "input": {
        "catalogExists": true,
        "lineageKnown": false,
        "changeTrigger": true,
        "reviewOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-reviewOwned",
      "input": {
        "catalogExists": true,
        "lineageKnown": true,
        "changeTrigger": true,
        "reviewOwned": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "catalogExists": true,
        "lineageKnown": true,
        "changeTrigger": true,
        "reviewOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-lineageKnown",
      "input": {
        "catalogExists": true,
        "lineageKnown": false,
        "changeTrigger": true,
        "reviewOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-reviewOwned",
      "input": {
        "catalogExists": true,
        "lineageKnown": true,
        "changeTrigger": true,
        "reviewOwned": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Data passport with purpose, owner, class and handling conditions.
- Source/derivative/copy and change-review record.

## References

- [NIST SP 800-122 · PII confidentiality foundation · April 2010](https://csrc.nist.gov/pubs/sp/800/122/final)
- [NIST SP 800-209 · Storage infrastructure security · October 2020](https://csrc.nist.gov/pubs/sp/800/209/final)